Cisco Talos expands threat hunting to firewall and identity

On June 4, 2026, Tony Giandomenico, Senior Director of Product Management at Cisco Talos, described an expansion of the company’s threat-hunting service. The effort extends hunting beyond endpoint telemetry to include Secure Firewall and identity signals from Duo and Cisco Identity Intelligence.

Threat hunting looks for attackers who have bypassed standard detection by examining telemetry and testing investigative hypotheses. Talos has operated hunting on Secure Endpoint data and will add searches of firewall telemetry and identity signals. The service will combine automated model-driven analysis with human review to help surface activity that automated systems may miss.

Giandomenico explained a core trade-off in automated detection: raising sensitivity produces more false alerts, while lowering it can let stealthy intrusions persist. He described Talos’ approach as a human-in-the-loop model that forms and tests hypotheses to find actors who slipped past controls. He said teams must balance alert volume against the risk of missed activity.

He also addressed rapid advances in large AI models and their effect on products and operations. “You don’t bring a knife to a gun fight, right? You’re going to use the same AI technology to speed things up there as well,” he said, adding that some features that might once have taken years to develop could appear much sooner as model capabilities increase.

Giandomenico drew on his past experience running a small cybersecurity consultancy in Hawaii to describe the management approach for complex launches. He said he learned finance, sales and how to influence colleagues across functions. “I have to influence them. I have to get them to understand and believe in the vision,” he recalled, and he emphasized that endurance and a clear sense of purpose help teams stay focused under pressure.

The expansion was announced in the June 4 interview and will add firewall and identity domains to Talos’ existing endpoint hunting while retaining analyst oversight for investigations.